tweak log message for blacklisted webmention domains
sanitize access tokens and Authorization headers

activitystreams-unofficial and oauth-dropins do this now, but do it here too just to be safe.
misc front page aesthetic tweaks
update readme